Kali Linux on WSL: Invalid repository signature and no gpg installed to fix

Question

I recently installed Kali under WSL, but I'm unable to run apt install (from network), apt update (to completion) or apt upgrade. The Kali repository is the sole member of sources.list, but its PGP signature is invalid. Unfortunately, the WSL distribution didn't ship with an install of PGP, so I'm unable to use apt-key add. Is the Kali WSL image broken, or suffering from a known bug? Can I run dpkg --install on a downloaded .deb so I'm able to run apt update?

Wow - I'm not sure why the downvotes here. This is a completely valid question, and a relatively new issue that I only found out about yesterday from this Unix & Linux Stack question. I'll write up a (shorter) answer here, but point you to that one for more detail if needed. — NotTheDr01ds, Dec 07 '21 at 19:45

score 3 · Accepted Answer · answered Dec 07 '21 at 19:50

3

Yes, this is a problem when installing Kali via wsl --install kali-linux.

For some reason, the command-line installer is using the (very, very, very) outdated 2019.2 release of Kali on a CDN. I can't figure out if this is a Microsoft issue (since the CDN seems to be owned by Microsoft), or a Kali issue (since Microsoft says Kali hasn't updated the files).

Kali is continuing to provide new releases for WSL, just that they update the Microsoft Store version. If you can install from the Microsoft Store, it is currently at 2021.3 and does update properly.

If you can't install from the Microsoft Store, I provide several alternatives in this Unix & Linux Stack answer.

answered Dec 07 '21 at 19:50

NotTheDr01ds

21,923

It's trivial to get the URL of the package (.msix or .appx) of whatever has been published on the Windows Store. – Ramhound Dec 07 '21 at 20:36
@Ramhound That's a good point. It won't fix the wsl --install kali-linux issue, since that's not using a Store package, but I'm assuming you are saying that's another "alternative" option for obtaining the tarball for a manual import? – NotTheDr01ds Dec 07 '21 at 20:40
Yes; It's a method when Microsoft has not specifically provided the archive themselves in their documentation for an offline install. Microsoft has habit of being slow or only have the most current archive. While the method I reference uses a third-party website, it does allow you, to capture whatever version of the archive you want. – Ramhound Dec 08 '21 at 00:04

Kali Linux on WSL: Invalid repository signature and no gpg installed to fix

1 Answers1

Linked